CVE-2026-27100: 
Java vulnerability analysis and mitigation

CVE-2026-27100 is a build information disclosure vulnerability in Jenkins core affecting the Run Parameter handling mechanism. Jenkins 2.550 and earlier (weekly) and LTS 2.541.1 and earlier accept Run Parameter values that reference builds the submitting user does not have access to, enabling unauthorized enumeration of job and build metadata. It was disclosed on February 18, 2026, as part of a Jenkins security advisory and was reported through the Jenkins Bug Bounty Program sponsored by the European Commission. The vulnerability carries a CVSS v3.1 base score of 4.3 (Medium) (Jenkins Advisory, Red Hat Bugzilla).

The root cause is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and CWE-551 (Incorrect Behavior Order: Authorization Before Parsing and Canonicalization), meaning Jenkins processes and accepts Run Parameter values before properly validating whether the requesting user has permission to access the referenced build. An authenticated attacker with Item/Build and Item/Configure permissions can craft a build submission that references builds in jobs outside their authorized scope, and Jenkins will respond with information confirming or denying the existence of those jobs/builds, as well as their display names if they exist. The attack vector is network-based, requires low privileges, and no user interaction (Jenkins Advisory).

Successful exploitation allows an attacker to perform reconnaissance against the Jenkins infrastructure beyond their assigned permissions — specifically, they can enumerate the existence of restricted jobs, confirm or deny the existence of specific builds, and retrieve display names of builds they are not authorized to view. While there is no direct code execution, integrity, or availability impact, the information gained can facilitate further targeted attacks or expose sensitive CI/CD pipeline structure details (Jenkins Advisory, Red Hat Bugzilla).

1. Reconnaissance: Identify a Jenkins instance running version 2.550 or earlier (weekly) or LTS 2.541.1 or earlier. Confirm the attacker has an account with Item/Build and Item/Configure permissions on at least one project.
2. Identify target jobs/builds: Determine job names or build IDs that the attacker suspects exist but does not have read access to (e.g., through naming conventions, partial information leakage, or social engineering).
3. Craft a malicious build submission: When triggering a parameterized build that accepts a Run Parameter, supply a value referencing a build in a restricted job (e.g., specifying a job name and build number the attacker should not have access to).
4. Observe the response: Jenkins will process the Run Parameter value and, depending on whether the referenced build exists and is accessible, return information confirming the job's existence, the build's existence, or its display name — rather than rejecting the request outright.
5. Enumerate infrastructure: Repeat the process with different job names and build numbers to map out the Jenkins CI/CD infrastructure, identifying restricted pipelines and build history (Jenkins Advisory).

• Logs: Jenkins access logs showing repeated parameterized build submissions from a single user referencing diverse job names or build IDs outside their normal project scope; unusual patterns of build trigger requests with Run Parameter values pointing to jobs the user does not own.
• Behavioral: A low-privileged user account submitting builds with Run Parameters referencing a wide variety of job/build combinations in a short time window, consistent with automated enumeration.
• Audit: Jenkins audit trail entries showing Item/Build actions by users against jobs they do not have Item/Read permission on.

Jenkins has released fixed versions that reject Run Parameter values referencing builds the submitting user cannot access: update to Jenkins weekly 2.551 or Jenkins LTS 2.541.2 (Jenkins Advisory). As an interim measure, restrict Item/Build and Item/Configure permissions to only trusted users, and apply the principle of least privilege across all Jenkins roles. Monitor Jenkins logs for anomalous Run Parameter usage patterns referencing out-of-scope builds. Red Hat has also tracked this issue for affected products (Red Hat Bugzilla).

The vulnerability was reported through the Jenkins Bug Bounty Program sponsored by the European Commission, with credit given to Suman Roy for the discovery (Jenkins Advisory). Several security news outlets covered the advisory, though most coverage conflated it with the higher-severity XSS vulnerability (CVE-2026-27099) disclosed in the same advisory. Community reaction has been relatively muted given the medium severity and the requirement for pre-existing authenticated access.